Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

modules-closure.sh: rewrite to use modinfo + small rust program #109094

Open
wants to merge 12 commits into
base: master
Choose a base branch
from

Conversation

xaverdh
Copy link
Contributor

@xaverdh xaverdh commented Jan 12, 2021

Motivation for this change

Should fix #60416 (leakage of information from the building system), because modinfo only looks at the dependency information in the modules themselves.
Because modinfo only lists direct dependencies, we have to compute the closure ourselves with this approach.

Same approach as #107871, but the closure computation happens in a small rust program.

Based on #109050 which should be merged before this!

Things done

This should produce bit-for-bit identical results compared to the old version (unless you have modules / module options on your kernel cmdline of course). You can (and should) check that with diffoscope. Well it actually won't because the store paths are different, but in a content addressed world they should..

  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@hazelweakly
Copy link

Out of idle curiosity, is there a reason more of the modules_closure.sh logic wasn't lifted into rust?

@xaverdh xaverdh force-pushed the modules-closure-modinfo-rust branch 2 times, most recently from ee2e9a4 to afa2eae Compare January 12, 2021 18:46
@xaverdh
Copy link
Contributor Author

xaverdh commented Jan 12, 2021

Out of idle curiosity, is there a reason more of the modules_closure.sh logic wasn't lifted into rust?

No reason in particular, I might do more actually.
I wanted to get something out there, to get some feedback first.

edit: I remember now. One piece of code that can not be easily ported to rust is nuke-ref..

@Profpatsch
Copy link
Member

Before I review this, it puts rustc into the kernel build closure, right? Do we already depend on rustc for that? Do we want to? I’d say it’s okay, but other people might have a different opinion.

@xaverdh
Copy link
Contributor Author

xaverdh commented Jan 24, 2021

Before I review this, it puts rustc into the kernel build closure, right? Do we already depend on rustc for that? Do we want to? I’d say it’s okay, but other people might have a different opinion.

I think it's not in the closure currently. But it should not be needed for compiling the kernel even with this. The piece of code here should only be needed when assembling an initrd. Maybe the rust program should go in all-packages, so its built by hydra? Then most people will never see rustc anyway, except for those that build everything from scratch.

By the way I just started to learn rust, so if you should review this I am very much interested in opinion on style etc. as well!

Copy link
Member

@Profpatsch Profpatsch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a full review, but a few comments

pkgs/build-support/kernel/closure.rs Outdated Show resolved Hide resolved
pkgs/build-support/kernel/closure.rs Outdated Show resolved Hide resolved
pkgs/build-support/kernel/closure.rs Outdated Show resolved Hide resolved
pkgs/build-support/kernel/closure.rs Outdated Show resolved Hide resolved
done

export allowMissing firmware
copy-closure "$kernel" "$out"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like there should be a bit more documentation of what copy-closure does, currently there is only the executable and the code

pkgs/build-support/kernel/modules-closure.sh Outdated Show resolved Hide resolved
pkgs/build-support/kernel/closure.rs Outdated Show resolved Hide resolved
@samueldr
Copy link
Member

samueldr commented Jan 25, 2021

The use right here is probably fine, it's strictly a "native build input" use case, so no cross-compilation will be required for this feature.

(The following does not really apply for this instance... But this is causing a precedent, so I will say it.)

With that said, adding Rust dependencies to the basic build environment without nix-build -A pkgsCross.aarch64-multiplatform.tests.writers.bin.rust building successfully is, in my opinion, a bad idea.

Adding Rust dependencies as things are currently would be a regression against cross-compiling NixOS, which @flokli had recently managed to manage without external workarounds for a few generations. (Before a regression in an upstream dep caused new breakage.)

@Mic92
Copy link
Member

Mic92 commented Jan 26, 2021

The use right here is probably fine, it's strictly a "native build input" use case, so no cross-compilation will be required for this feature.

(The following does not really apply for this instance... But this is causing a precedent, so I will say it.)

With that said, adding Rust dependencies to the basic build environment without nix-build -A pkgsCross.aarch64-multiplatform.tests.writers.bin.rust building successfully is, in my opinion, a bad idea.

Adding Rust dependencies as things are currently would be a regression against cross-compiling NixOS, which @flokli had recently managed to manage without external workarounds for a few generations. (Before a regression in an upstream dep caused new breakage.)

I think our rust infrastructure should be cross-compile ready. I don't know about writers but a fix should not be that complicated. Otherwise just switching to buildRustPackage would be the easy fix.

@samueldr
Copy link
Member

I think our rust infrastructure should be cross-compile ready. I don't know about writers but a fix should not be that complicated. Otherwise just switching to buildRustPackage would be the easy fix.

Hm, I guess I had a wrong commit up when I last tried, yesterday, as it failed to build relatively early. Trying fresh, and the writeRust writer currently doesn't work, but manix cross-compiled fine. So there's some work to do yet, but nothing too concerning as our Rust ecosystem itself proves to be able to manage.

We don't yet have a job in Hydra to look at to guesstimate whether Rust cross-compilation through pkgsCross is consistently working well or not.

Note that the concern is still present: we shouldn't add dependencies (any!) to the base system unless cross-compilation for them is figured out.

Sorry to for the noise right here.

@Mic92
Copy link
Member

Mic92 commented Jan 27, 2021

I think our rust infrastructure should be cross-compile ready. I don't know about writers but a fix should not be that complicated. Otherwise just switching to buildRustPackage would be the easy fix.

Hm, I guess I had a wrong commit up when I last tried, yesterday, as it failed to build relatively early. Trying fresh, and the writeRust writer currently doesn't work, but manix cross-compiled fine. So there's some work to do yet, but nothing too concerning as our Rust ecosystem itself proves to be able to manage.

We don't yet have a job in Hydra to look at to guesstimate whether Rust cross-compilation through pkgsCross is consistently working well or not.

Note that the concern is still present: we shouldn't add dependencies (any!) to the base system unless cross-compilation for them is figured out.

Sorry to for the noise right here.

Yeah, this is up to people interested in cross-compilation and not in the scope of this PR. Right now it is too much of a burden to ask contributors to test cross-compilation like this one if it the majority of dependencies to cross-compile NixOS are not cached by hydra.

@samueldr
Copy link
Member

Yeah, this is up to people interested in cross-compilation and not in the scope of this PR.

Hm...

Right now it is too much of a burden to ask contributors to test cross-compilation like this one if it the majority of dependencies to cross-compile NixOS are not cached by hydra.

I would agree on a simple change, but this is about introducing a totally new ecosystem as a basic build dependency to NixOS. This is a design decision with broad repercussions.

Yes it is up to the people interested in cross-compilation, and here I am, stating my concerns.

I agree that it is too much of a burden right now to test it. I'm not asking that the change works as it is with cross-compilation. I'm asking that, as a distribution, we properly consider whether it is causing more breakage than it is worth.

In this instance adding Rust is okay, it looks like it does cross-compile with pkgsCross. Sure, writers fail, but at the very least the ecosystem is not completely in a bad state. If it had been in a bad state like it was during last year (not working), then it would have been a different thing.

I will state it again, in case people only skim my message: I am not against the change. I am bringing up concerns that any decisions to greatly affect the build closure of the base system should keep in mind that cross-compilation should be in a good enough state. It's fine if it doesn't work at the moment, things are still in flux, but they have to be in a place where it is known that cross-compilation was working fine recently.

[...] it is up to people interested in cross-compilation

Repeating this from your message again. What is the solution, if not to raise concerns? Should this get merged-in, then someone interested in cross-compilation comes behind, reverts?

@Mic92
Copy link
Member

Mic92 commented Jan 28, 2021

Repeating this from your message again. What is the solution, if not to raise concerns? Should this get merged-in, then someone interested in cross-compilation comes behind, reverts?

I was talking about adding rust to pkgsCross not beeing in scope of this PR. Not the other stuff.

@xaverdh xaverdh force-pushed the modules-closure-modinfo-rust branch from bc7a79d to ac931e5 Compare January 29, 2021 17:31
@xaverdh
Copy link
Contributor Author

xaverdh commented Jan 29, 2021

wrt. cross compiling, am I correct that putting the rust helper in a proper package and using buildRustPackage will fix the issue (then I will just do that)?

@samueldr
Copy link
Member

Or use packages from buildPackages in nativeBuildInputs. Though exposing the tool as a package isn't a bad idea either.

@flokli
Copy link
Contributor

flokli commented Apr 20, 2022 via email

@06kellyjac
Copy link
Member

I'm playing around with some code changes and fixing some clippy warnings etc.
What's the best way to test this? 🙂

@xaverdh
Copy link
Contributor Author

xaverdh commented Apr 22, 2022

I'm playing around with some code changes and fixing some clippy warnings etc. What's the best way to test this? slightly_smiling_face

You want to build the config.system.build.bootStage1.modulesClosure attribute of a nixos configuration (with nixpkgs pointed to a checkout of this pr).
I then compare this with a build of the same attribute from the master branch, ideally there should be no differences apart from impurities introduced by the old approach.

@xaverdh xaverdh force-pushed the modules-closure-modinfo-rust branch from ce7ca6e to c0ffd28 Compare April 23, 2022 12:07
@xaverdh
Copy link
Contributor Author

xaverdh commented May 3, 2022

concerning documentation, should I add a README in pkgs/build-support/kernel/copy-modules-closure?

@xaverdh
Copy link
Contributor Author

xaverdh commented May 3, 2022

There already is a short description in pkgs/build-support/kernel/modules-closure.nix. The split between the two is a bit weird, should I make the rust program call depmod as well, or is it good to separate the two steps?

@flokli flokli requested review from Mic92 and samueldr May 5, 2022 17:27
@stale stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Nov 2, 2022
@stale stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Nov 27, 2022
@stale stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jun 18, 2023
@stale stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Mar 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Kernel build is not sandboxed
8 participants